<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><head>
<title>Types, realms, roles, and permissions</title>
<style type="text/css">
		/* Style for specific inline images */
		
		/* Style for specific ordered lists */
		
		/* Style for specific table cells */
		</style>
<link type="text/css" href="/library/skin/tool_base.css" media="all" rel="stylesheet" />
<link type="text/css" href="/library/skin/default/tool.css" media="all" rel="stylesheet" />
</head>
<body>
<div class="helpBody">
<h2>Types, realms, roles, and permissions</h2>

<h3>Types</h3>

<p>Type is the broadest user designation within Sakai. Types can be administrative or
non-administrative:</p>

<ul><li><strong>Administrative:</strong> Users with administrative account
types can access tools (in <a href="content.hlp?docId=aqzy">My Workspace</a>) that
non-administrative users cannot. These tools, such as Users, Realms,
and Sites, allow for the creation, deletion, and general
administration of sites, participants, and their roles. The
administrative type also has privileges and permissions that aren't
available to any other user. For example, it can see and edit all
sites.

<p>Upon installation, the administrative type is the only account, and
is used to create worksites. After adding users to the system (using
the User tool), the administrative type can bestow upon
non-administrative users the ability to create new sites by giving
them the user type "registered" or "maintain" (defined below).</p>
</li><li><strong>Non-administrative:</strong> Non-administrative account
types are defined essentially by their ability to create new
sites. There are three default non-administrative account types:

<br /><br />

<ul><li><strong>Registered:</strong> This type can create new sites. When
you create an account with the "New Account widget", you create a
"registered" type account.

<p><strong>Note:</strong> The ability to create a site is derived from the
 <code>site.add</code> permission granted in the
 <code>!user.template.registered</code> realm. Complicating this,
 however, is the fact that a user account type has associated with it
 both <code>.auth</code> (authorized) and <code>.anon</code>
 (anonymous, i.e., not logged in) roles. Strictly speaking, it is the
 <code>site.add</code> permission in the <code>.auth</code> role of
 <code>!user.template.registered</code> that grants the permission.</p>
</li><li><strong>Maintain:</strong> This type exists within the application
for legacy reasons; its functionality is the same as "registered".


<p><strong>Note:</strong> Do
not confuse the account type "maintain" with the role of "maintain",
which you may grant to a user in a particular site or for a particular
tool. Account type and role in a worksite serve different purposes.</p>



</li><li><strong>Guest:</strong> By default, this user type cannot create
worksites.</li></ul></li></ul>

<p><strong>Note:</strong> Sites can also have types (e.g., course
sites and project sites), which determine what default roles the site
recognizes. For example, a course site might get the
<code>!site.template.course</code> roles (i.e., those defined by the
<code>!site.template.course</code> realm).</p>

<p>The default site roles,
which can be changed by the administrative user type, are "maintain"
and "access". Each implementation can be tailored
differently, with different roles assigned to users.  Each of these
roles has a different matrix of permitted abilities within the site.</p>

<h3>Realms and roles</h3>

<p>Realms are packages of security grants that determine roles for
accounts within a site. The permissions enabled for roles can be
unique to each site. The defaults are set in the worksite's default
template (e.g., <code>!site.template.course</code> for a course site,
or <code>!site.template.project</code> for a project site).</p>

<p>For non-administrative users, the ability to create sites is
outside the scope of a particular worksite, and is determined by the
type of account (as described above in the "Types" section). The
account type determines which realm template the user has, and within
the realm template is the control for ability to create sites, for
example:</p>

<ul><li>By default, the "registered" account type gets the realm template
<code>!user.template.registered</code>, which has the
<code>site.add</code> permission enabled. Therefore, any users with
the "registered" account type will be able to create worksites.<br /><br />

</li><li>By default, the "guest" account type gets the realm template
<code>!user.template.guest</code> realm, which does not have the
<code>site.add</code> permission enabled. Therefore, any users with
the "guest" account type will not be able to create worksites.
</li></ul>



<p>When "registered" users create worksites, they automatically become
a member of the site, and have (by default) roles that enable full
permissions. By specifying roles for new users, site creators have the
ability to control how participants use and/or interact with tools in
the worksite. The role can be one of the default roles ("maintain" and
"access"), or it can be a role that the administrator has
created with the Realm tool.</p>


<p>All users have the broadest permissions (i.e., the ability create,
edit, and delete) in their respective My Workspace tabs.</p>

<h3>Permissions</h3>

<p>In general, the default
"maintain" role has full permission to create, edit, and delete within
a worksite. The default "access" role has fewer permissions, and
cannot create or delete content in every tool (i.e., by default, the
"access" role cannot upload files into Resources, but it can create
Chat messages and Discussion replies).</p>

<p> Roles that have worksite edit capabilities (e.g.,
the default "maintain"
role) can change the permissions for tools,
determining how participants can use them.</p>

<p>For a more information about permissions, see the Sakaipedia's
Permissions list at:</p>

<span class="example">  <a href="http://bugs.sakaiproject.org/confluence/display/ENC/Permissions+list" target="new">http://bugs.sakaiproject.org/confluence/display/ENC/Permissions+list</a></span>

<p />

</div>
</body></html>